CVE-2020-10731

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines.

CVSS v3 9.9 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1831544	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:openstack_platform:15.0:::::::*
	cpe:2.3:a:redhat:openstack_platform:16.0:::::::*
	cpe:2.3:a:redhat:openstack_platform:16.1:::::::*

History

19 Oct 2021, 13:00

Type	Values Removed	Values Added
CWE	~~CWE-269~~	NVD-CWE-noinfo

Information

Published : 2020-07-31 13:15

Updated : 2023-12-10 13:27

NVD link : CVE-2020-10731

Mitre link : CVE-2020-10731

CVE.ORG link : CVE-2020-10731

JSON object : View

Products Affected

redhat

openstack_platform

CWE

NVD-CWE-noinfo CWE-284

Improper Access Control

{"id": "CVE-2020-10731", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2020-07-31T13:15:12.383", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831544", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en el contenedor nova_libvirt provisto por el Red Hat OpenStack Platform versi\u00f3n 16, donde no se encuentra habilitado SELinux. Este fallo causa que sVirt, un importante mecanismo de aislamiento, se deshabilite para todas las m\u00e1quinas virtuales en ejecuci\u00f3n"}], "lastModified": "2021-10-19T13:00:06.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack_platform:15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7716ED5D-8213-49E9-AAA6-8C4B45FFE3B0"}, {"criteria": "cpe:2.3:a:redhat:openstack_platform:16.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0C9F10E-F45D-4EA7-B39A-5298DDE84FCC"}, {"criteria": "cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCC81071-B46D-4F5D-AC25-B4A4CCC20C73"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}